lowaccess-controlverified ✓rollback-safe

Configure SSH warning banner

ssh-banner · RHEL ≥ 8 · 2 impls

Description

The SSH daemon must display a warning banner before authentication. The Banner directive specifies a file whose contents are sent to connecting clients prior to authentication, providing legal notice that the system is monitored and unauthorized access is prohibited.

Rationale

A pre-authentication banner establishes the legal basis for monitoring and prosecution of unauthorized access. Without a warning banner, an attacker may claim they were unaware the system was restricted, weakening the organization's legal standing in the event of a security incident or prosecution.

Check → Remediate

Checkcommand

val=$(sshd -T 2>/dev/null | grep -i '^banner ' | awk '{print $2}')
if [ -z "$val" ] || [ "$val" = "none" ]; then
  echo "FAIL: banner not configured"
  exit 1
fi
if [ "$val" = "/etc/issue" ] || [ "$val" = "/etc/issue.net" ]; then
  echo "OK: banner=$val"
  exit 0
fi
echo "FAIL: banner=$val (expected /etc/issue or /etc/issue.net)"
exit 1

expected_exit:: 0

Remediateconfig_set

path:: /etc/ssh/sshd_config
key:: Banner
value:: /etc/issue
separator:
reload:: sshd

Framework references

CIS

rhel10 5.1.5rhel8 5.1.7rhel9 5.1.8

STIG

V-281224 / RHEL-10-700010V-257981 / RHEL-09-255025V-230225 / RHEL-08-010040

NIST 800-53

AC-8

Live verification

rhel10:checkrhel8:checkrhel9:check

#ssh#banner#notice